CVE-2026-90120 (GCVE-0-2026-90120)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-18 17:53
VLAI
Title
irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing
Summary
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing In gic_acpi_parse_iaffid() a given MADT GICC entry might not correspond to a logical cpu recognized by the kernel, resulting in the cpu variable initialization to an error value. Currently, the get_logical_index() return value is not checked for failure, which might result in out-of-bounds memory corruption while trying to index a per_cpu variable array. Add a check to evaluate get_logical_index() return value.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 35866efa52feaf48cc54a0745851a555654e1446 , < 6caeb878f809bdf0aec2fdd96f3d41ef4b69fc69 (git)
Affected: 35866efa52feaf48cc54a0745851a555654e1446 , < 328affc639ce9873a7a0a3fd6b8339f19767529b (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/irqchip/irq-gic-v5-irs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6caeb878f809bdf0aec2fdd96f3d41ef4b69fc69",
              "status": "affected",
              "version": "35866efa52feaf48cc54a0745851a555654e1446",
              "versionType": "git"
            },
            {
              "lessThan": "328affc639ce9873a7a0a3fd6b8339f19767529b",
              "status": "affected",
              "version": "35866efa52feaf48cc54a0745851a555654e1446",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/irqchip/irq-gic-v5-irs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing\n\nIn gic_acpi_parse_iaffid() a given MADT GICC entry might not correspond\nto a logical cpu recognized by the kernel, resulting in the cpu variable\ninitialization to an error value.\n\nCurrently, the get_logical_index() return value is not checked for failure,\nwhich might result in out-of-bounds memory corruption while trying to\nindex a per_cpu variable array.\n\nAdd a check to evaluate get_logical_index() return value."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The triggering bytes are MADT GICC arm_mpidr/iaffid/irs_id fields parsed by gic_acpi_parse_iaffid() from acpi_table_parse_madt() on the init_IRQ()-\u003eirqchip_init()-\u003egic_acpi_init()-\u003egicv5_irs_acpi_probe() boot path; they arrive from firmware, a hypervisor ACPI blob, or an initrd MADT override, not from a network protocol message.\nAC:L - A MADT GICC with ACPI_MADT_ENABLED set and an arm_mpidr that acpi_map_gic_cpu_interface() never installed (invalid MPIDR, or cpu_count \u003e= NR_CPUS) makes get_logical_index() return -EINVAL every boot; per_cpu() then uses that error index with no race or attacker-uncontrollable layout.\nPR:N - gic_acpi_parse_iaffid() is an __init MADT walker with no capable() or uid check, invoked from irqchip_init() before userspace; a crafted MADT GICC is consumed automatically, so no Linux account or user-namespace capability is required.\nUI:N - arm64 init_IRQ() calls irqchip_init(), which probes the GICv5 IRS MADT entry and walks GICC subtables via gicv5_irs_acpi_init_affinity(); the OOB store happens on that boot parse with no mount, open, or other victim action.\nS:U - The stores go to per_cpu(cpu_iaffid, cpu) and per_cpu(per_cpu_irs_data, cpu) in the host GICv5 IRS affinity setup; this stays inside the kernel\u0027s authority and is not a KVM guest-to-host, IOMMU, or sandbox crossing.\nC:H - Using get_logical_index()\u0027s -EINVAL as the cpu argument to per_cpu() is an out-of-bounds write of gicc-\u003eiaffid and a kmalloc\u0027d gicv5_irs_chip_data pointer through __per_cpu_offset[]; that kernel memory corruption can be leveraged for information disclosure.\nI:H - gic_acpi_parse_iaffid() writes gicc-\u003eiaffid, valid=true, and current_irs_data via per_cpu(cpu_iaffid/per_cpu_irs_data, cpu) when cpu is -EINVAL, corrupting memory outside the per-cpu arrays with attacker-influenced MADT data and a kernel heap pointer.\nA:H - __per_cpu_offset[-EINVAL] plus the subsequent per_cpu stores during gicv5_irs_acpi_probe() can target unmapped or live kernel data and oops/panic in init_IRQ() while bringing up GICv5, which is a full kernel availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:09.058Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6caeb878f809bdf0aec2fdd96f3d41ef4b69fc69"
        },
        {
          "url": "https://git.kernel.org/stable/c/328affc639ce9873a7a0a3fd6b8339f19767529b"
        }
      ],
      "title": "irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90120",
    "datePublished": "2026-09-17T16:06:24.607Z",
    "dateReserved": "2026-09-11T19:38:34.787Z",
    "dateUpdated": "2026-09-18T17:53:09.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90120",
      "date": "2026-09-25",
      "epss": "0.002",
      "percentile": "0.08725"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/irqchip/irq-gic-v5-irs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6caeb878f809bdf0aec2fdd96f3d41ef4b69fc69",
                    "status": "affected",
                    "version": "35866efa52feaf48cc54a0745851a555654e1446",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "328affc639ce9873a7a0a3fd6b8339f19767529b",
                    "status": "affected",
                    "version": "35866efa52feaf48cc54a0745851a555654e1446",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/irqchip/irq-gic-v5-irs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing\n\nIn gic_acpi_parse_iaffid() a given MADT GICC entry might not correspond\nto a logical cpu recognized by the kernel, resulting in the cpu variable\ninitialization to an error value.\n\nCurrently, the get_logical_index() return value is not checked for failure,\nwhich might result in out-of-bounds memory corruption while trying to\nindex a per_cpu variable array.\n\nAdd a check to evaluate get_logical_index() return value."
          }
        ],
        "id": "CVE-2026-90120",
        "lastModified": "2026-09-18T18:17:42.750",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:04.200",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/328affc639ce9873a7a0a3fd6b8339f19767529b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6caeb878f809bdf0aec2fdd96f3d41ef4b69fc69"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.